CVE-2026-93344 in MarketKing Plugin
Summary
by MITRE • 09/22/2026
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_get_page_content AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by supplying an arbitrary vendor user ID. Attackers can bypass authorization controls by submitting a target vendor ID in the request to access payout pages, financial reports, and vendor dashboard content belonging to any vendor in the marketplace.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified within MarketKing plugin versions prior to 2.1.72 represents a critical failure in server-side access control mechanisms, specifically manifesting as an insecure direct object reference or broken authorization flaw. This issue resides within the marketking_get_page_content AJAX action handler, which is designed to retrieve content for various administrative and vendor-facing pages. The core technical deficiency lies in the application's logic when processing requests from authenticated users. While the system correctly verifies that a user possesses valid credentials and at least subscriber-level privileges, it fails to adequately validate whether the requesting user has permission to access resources associated with other vendors within the marketplace ecosystem. By allowing an attacker to supply an arbitrary vendor user ID as a parameter in their request, the application blindly trusts this input without performing sufficient ownership verification or role-based access control checks against the authenticated session context.
From a technical perspective, this vulnerability enables horizontal privilege escalation for any account holding subscriber-level permissions or higher within the WordPress environment. In typical multi-vendor marketplace architectures, such as those built on WooCommerce with MarketKing, strict isolation is required between different vendor entities to ensure data privacy and financial security. The absence of these checks means that an attacker can manipulate the target identifier in the AJAX payload to point towards a victim vendor's administrative interface. This bypasses the intended authorization boundaries, allowing the malicious actor to interact with sensitive endpoints as if they were the legitimate administrator or owner of that specific vendor account. The flaw is particularly dangerous because it leverages standard authenticated access paths rather than requiring unauthenticated exploitation, making detection by automated scanners less immediate unless behavioral analysis is employed.
The operational impact of this vulnerability is severe due to the sensitivity of the data and functions accessible through the compromised endpoints. Attackers can gain unauthorized visibility into payout pages, which may reveal financial transaction details, bank account information, or commission structures belonging to other vendors. Furthermore, access to financial reports exposes detailed sales metrics, tax implications, and performance analytics that are considered confidential business intelligence. The ability to view vendor dashboard content allows attackers to understand the operational status of competitors or partners within the marketplace, potentially facilitating further targeted attacks such as social engineering or supply chain compromises. This level of information disclosure not only violates data privacy regulations but also undermines trust in the platform's security posture among its merchant base.
In terms of industry classification standards, this vulnerability aligns with CWE-284 Improper Access Control and specifically CWE-639 Authorization Bypass Through User-Controlled Key. The exploitation technique maps directly to MITRE ATT&CK techniques related to Privilege Escalation via Insecure Direct Object References (IDOR), where the attacker manipulates object identifiers to access unauthorized resources. This pattern is common in web applications that rely on client-supplied IDs for resource lookup without validating ownership against the authenticated user's profile or session data. The lack of server-side validation ensures that any valid user can traverse between vendor accounts, effectively breaking the multi-tenancy isolation model essential for marketplace platforms.
To mitigate this vulnerability, immediate action is required to upgrade the MarketKing plugin to version 2.1.72 or later, where these authorization checks have been corrected. For organizations unable to patch immediately due to compatibility constraints, implementing a web application firewall rule that monitors AJAX requests for patterns indicative of IDOR attacks can provide temporary protection. This includes detecting unusual variations in vendor IDs submitted by low-privilege users accessing high-sensitivity endpoints like financial reports or payout pages. Additionally, developers should review the marketking_get_page_content handler to ensure it explicitly verifies that the authenticated user's account is either an administrator with global privileges or the specific owner of the requested vendor ID before rendering any content. Enforcing strict role-based access control policies and logging all authorization failures can also aid in detecting ongoing exploitation attempts while permanent fixes are deployed.